The digital asset market is growing in Brazil, and the rules for companies operating with crypto assets are becoming more specific. In this scenario, having a good product is not enough: companies need to understand which rules apply to their business, which activities are regulated, and who is responsible for each stage.
The Central Bank of Brazil has established specific rules for companies providing certain virtual asset services, including Virtual Asset Service Provider Companies (SPSAVs). Depending on their authorization category, these companies may act as intermediaries, custodians, or brokers of virtual assets.
To understand how these changes affect a business, the first step is to analyze how its products and services operate in practice. This involves mapping the flow of funds, the services offered, the parties involved, and the activities performed by partners.
Based on this assessment, a company can evaluate different ways of structuring its business, such as seeking its own authorization or working with regulated partners for specific functions.
What has changed for companies working with digital assets?
For a long time, Brazil's digital asset market was subject to broader rules. As the sector matured, the regulatory framework began to include specific requirements for certain service providers.
BCB Resolution No. 520 of 2025 establishes rules for the incorporation and operation of SPSAVs and defines three categories of activity:
virtual asset intermediaries;
virtual asset custodians;
virtual asset brokers.
The regulation also establishes which activities these companies may perform.
In addition, certain virtual asset transactions have become subject to rules related to the foreign exchange market. Since February 2026, for example, certain transactions have included international payments or transfers involving virtual assets, as well as transactions involving the purchase, sale, or exchange of virtual assets referenced to fiat currency.
In practice, this means that a crypto company needs to analyze how its services operate as a whole, rather than looking only at the experience presented to the user.
Where can regulatory risk arise?
The first step to mitigating regulatory risk in a crypto operation is understanding exactly which activities the company performs.
A platform may offer the purchase and sale of digital assets, for example, while relying on other processes to deliver that service. These may include moving BRL, currency conversion, custody, payments, and settlement.
Some questions can help identify potential areas of concern:
Does the company intermediate the purchase and sale of virtual assets?
Does it hold customers' assets?
Does it transfer virtual assets?
Does it convert BRL or other currencies into digital assets?
Does it process payments or collections?
Does it hold customer funds?
Does it participate in international transactions?
Which activities are performed internally and which are handled by partners?
It is also important to track the flow of funds. For example:
Customer → BRL → account → conversion → digital asset → customer's wallet
At each stage, the company needs to identify who performs the activity, who controls the process, and who maintains the customer relationship.
This mapping helps identify potential areas of exposure and determine which functions require specific controls or an authorized partner.
How can you assess regulatory exposure?
Before deciding between obtaining your own authorization and working with a regulated partner, it is useful to assess your current operating model. A simple way to start is by creating an operational map.
1. List your products and services
Start with the products offered to customers. Then identify everything that needs to happen to deliver each one.
For example, a platform may offer digital asset trading while using a third party to move BRL or process certain payments.
2. Map the flow of funds
Identify how funds enter, move through, and leave the business.
A flow could look like this:
Customer → BRL → company account → conversion → digital asset → customer
For international transactions, the flow may also involve FX, banks, liquidity providers, and different networks.
This exercise helps visualize the participants and activities involved at each stage.
3. Define responsibilities
For each activity, answer three questions:
Who performs it? Who controls it? Who is responsible for the customer?
This distinction is particularly important when third parties are involved. Hiring a partner does not, by itself, mean that all responsibilities associated with the activity are transferred to that partner.
4. Assess existing controls
It is also important to evaluate how the company and its service providers handle areas such as:
customer identification;
anti-money laundering;
transaction monitoring;
fraud prevention;
risk management;
security;
record keeping;
other applicable requirements.
The goal is to identify which mechanisms are already in place and where gaps need to be addressed.
When should a company seek its own authorization?
A company may choose to apply for authorization to directly perform certain regulated activities.
This approach may make sense when financial services are a central part of the company's long-term strategy and the company wants greater control over how they are delivered.
However, obtaining its own authorization also means taking on a range of responsibilities. This may require investment in:
governance;
compliance;
risk management;
internal controls;
technology;
security;
operational processes;
regulatory infrastructure.
The Central Bank established specific rules for SPSAV authorization procedures through BCB Resolution No. 519.
Obtaining authorization is therefore not simply a legal decision. It is also a decision about how much control, investment, and responsibility the company wants to assume internally.
Can a regulated partner be an alternative?
Depending on the business model, certain functions may be performed by an authorized institution or service provider.
In this model, the company maintains its product and customer relationship, while the partner provides some of the services required to deliver the financial experience.
These services may include:
BRL accounts;
Pix;
payments and collections;
movement of funds;
currency conversion;
settlement;
other financial services.
This approach can reduce the need to develop every component internally.
However, it is important to distinguish between performing an activity and being responsible for the business. Hiring a third party does not automatically eliminate the company's obligations.
Contracts and processes should therefore clearly define:
what the partner does + what the company does + who is responsible for each activity.
How can you mitigate regulatory risks in a crypto operation?
After mapping products, flows, and responsibilities, several measures can help reduce exposure:
Understand your business model
Identify the products, services, financial flows, and participants involved.
Define responsibilities
Clearly establish which activities are managed internally and which are performed by third parties.
Check authorizations
Verify that partners hold the necessary authorizations to provide the contracted services.
Strengthen controls
Maintain appropriate processes for customer identification, transaction monitoring, fraud prevention, and risk management.
Document processes
Record how funds enter, move through, and leave the business. Documentation makes it easier to identify gaps and update procedures.
Monitor regulatory developments
The rules governing the digital asset market continue to evolve. In 2026, for example, the Central Bank published new rules related to SPSAVs, including prudential requirements and changes to fraud-prevention procedures.
Being compliant today therefore does not mean that processes will not need to be reviewed in the future.
Regulated partner or your own authorization?
Mitigating regulatory risks in a crypto operation starts with understanding how the business works in practice. This means analyzing the activities performed, the flow of funds, the systems used, the partners involved, and the responsibilities of each participant.
Based on this assessment, a company can determine which model makes the most sense for its operation: seeking its own authorization, working with regulated partners, or combining different approaches.
Having the right financial infrastructure can also reduce operational complexity and make it easier to connect digital assets with Brazil's financial system.
Does your crypto company need to move BRL and connect to Brazil's financial system? Talk to the Transfero team and learn about our infrastructure for digital asset operations.
